Summary
The signup page at https:
Technical Description
During security testing of the Amplenote signup functionality, it was observed that the application accepts passwords that are considered weak and easily guessable. The password validation mechanism does not adequately enforce strong password requirements such as minimum complexity, resistance against common passwords, or entropy checks.
Although Amplenote documents that user passwords are securely hashed with bcrypt, weak password acceptance increases the likelihood that accounts can be compromised through password guessing, credential stuffing, or brute-force attacks if users choose predictable passwords.
Steps to Reproduce
Navigate to:
https:
Enter a valid email address.
Choose a weak password (for example, a simple dictionary word or easily predictable password).
Complete the remaining signup fields.
Submit the registration form.
Observe that the account is successfully created despite the weak password.
Working Proof of Concept
Target URL
https:
Example Test Passwords
password
password123
qwerty123
welcome1
abc12345
memonmemon (or another simple repeated word)
Observed Result
The application accepts the weak password and allows account creation.
Expected Result
The application should reject weak passwords and require users to create passwords that meet strong security requirements, including sufficient length, complexity, and resistance against commonly used passwords.
Attack Scenario
An attacker can exploit users who select weak passwords by performing:
Online password guessing attacks.
Credential stuffing using passwords leaked from previous data breaches.
Automated brute-force attacks against user accounts.
Targeted account takeover attempts using common password dictionaries.
If users reuse weak passwords across multiple services, the likelihood of successful account compromise increases significantly.
User Impact
User accounts become easier to compromise.
Unauthorized access to sensitive notes and personal information.
Loss of confidentiality and privacy.
Increased risk of identity theft if credentials are reused elsewhere.
Business Impact
Increased account takeover incidents.
Loss of customer trust.
Higher support costs related to compromised accounts.
Potential reputational damage.
Increased security risk despite secure password storage mechanisms.
Remediation
Implement a stronger password policy by:
Requiring a minimum password length of at least 12 characters.
Enforcing a combination of uppercase letters, lowercase letters, numbers, and special characters, or using a modern entropy-based policy.
Rejecting commonly used and breached passwords.
Integrating password strength validation (for example, using a breached-password database).
Encouraging the use of password managers and passphrases instead of simple passwords.
Providing real-time password strength feedback during account registration.
Security References
OWASP Authentication Cheat Sheet
NIST SP 800-63B Digital Identity Guidelines
Amplenote Security Documentation (bcrypt password hashing and authentication design).